How to use
Open “Password” — a 20-character password is already generated. Press “Copy” to use it.
Set the length with the slider and toggle upper case, lower case, digits and symbols. Remove symbols a site rejects in “Symbols to use” or list them in “Exclude characters”.
For something memorable, switch to “Passphrase” and choose the number of words, separator and capitalization.
Check the strength meter and the crack-time table. Need several? Raise “How many” and save them as .txt.
To test a password you already use, open “Strength check”. Analysis happens only on this device.
What it does
Fine-grained character rules
Length 4–128, any mix of upper, lower, digits and symbols, and the symbol list itself is editable character by character. Exclude look-alikes such as 0/O and 1/l, require one of each set, or forbid identical adjacent characters.
Unbiased cryptographic randomness
All randomness comes from crypto.getRandomValues with rejection sampling, so there is no modulo bias. Rules like “include one of each” are enforced by drawing uniformly from all valid passwords, so the entropy shown matches how passwords are actually made.
Exact entropy
The number of valid passwords is counted exactly with inclusion–exclusion and shown in bits. Average crack times are given for four attack scenarios — from throttled online guessing to GPU attacks on fast hashes — with the assumptions spelled out.
EFF word-list passphrases
Words are drawn from the Electronic Frontier Foundation’s 7,776-word list — about 12.9 bits each. Choose the separator and capitalization, and optionally add a digit or symbol.
A checker that explains weak spots
Detects ~10,000 common passwords, English words, Japanese romaji favourites, keyboard walks (qwerty, 1qaz), sequences, repeats and dates — and sees through swaps like P@ssw0rd — before estimating strength.
Careful with what is on screen
Mask generated passwords, or have them cleared from the screen 60 seconds after copying. Nothing you type is stored, sent or included in analytics.
Use cases
- Create a strong password for a site that only accepts certain symbols
- Make a memorable passphrase for a computer login or Wi-Fi you type by hand
- Issue initial passwords for staff in bulk, without confusing characters
- Find out how hard your current password is to crack — without sending it anywhere
- Explain how strong a password policy (length, character sets) really is
Supported formats
Generate
Strength check detects
Capability matrix
| Feature | Support | Notes |
|---|---|---|
| Random passwords with custom rules | Supported | 4–128 characters, per-symbol control |
| Passphrases | Supported | EFF Large Wordlist (English) |
| Entropy and crack-time estimates | Supported | Four attack scenarios |
| Strength check for your own password | Partial | Pattern-based estimate; cannot reproduce every attacker dictionary |
| Passphrases from Japanese words | Not supported | English list only, for easy typing |
| Breach lookup (Have I Been Pwned etc.) | Not supported | Requires a network request, so not supported |
| Saving or syncing passwords | Not supported | Use a dedicated password manager |
| Offline use | Supported | Works without a connection once loaded |
Limits & notes
- Passwords 4–128 characters, passphrases 3–20 words, up to 1,000 per batch.
- Symbols are the 32 printable ASCII symbols; full-width characters and emoji cannot be included.
- The strength checker analyses the first 128 characters.
- Crack times are averages and vary widely with attacker hardware and how the service stores passwords.
- Copied text stays on your clipboard. On shared computers, overwrite it after use.
Privacy & safety
Generated passwords and anything typed into the strength checker stay inside your browser. Nothing is sent to a server, saved to browser storage (localStorage etc.) or recorded in analytics. Closing the page or pressing “Clear from screen” removes them from view.
FAQ
How long should a secure password be?
Is a passphrase or a password more secure?
Is the password I type into the checker sent anywhere?
Does replacing letters with symbols (P@ssw0rd) help?
Can I check whether my password has been leaked?
Related tools
Crypto Studio — Hash, HMAC, Encryption & Keys
Type text and see 12 hashes — SHA-256, SHA-3, BLAKE3 and more — at once. Verify webhook HMAC signatures, encrypt text with a password, generate key pairs and create or check bcrypt hashes, all on your own device with nothing uploaded.
Secret Scanner
Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.
Share Safe
Before you hand a file over, see what is hiding in it — listed per file with severity — and get a safe copy with everything removable removed. The copy is re-checked afterwards, and whatever is left comes with manual steps. Files are never uploaded.
Last updated: